docs: record verified voice web production deployment

QUALIFICATION.md

@@ -1,6 +1,6 @@
 # Multi-user Hermes migration — qualification and operations
 
-## Dedicated web voice session refinement — 2026-10-04 (local only; not deployed)
+## Dedicated web voice session refinement — 2026-10-04 (local qualification and production follow-up)
 
 Local browser qualification exercised the actual web app's voice start, mute,
 unmute, transcript-packet handling and end lifecycle with fake LiveKit at
@@ -20,10 +20,36 @@ position, selected durable-history isolation, and the HTTP-only compatibility
 composer. Fake transport and simulated microphone failures are browser lifecycle
 evidence, not physical audio qualification.
 
-No credentials, live APIs or NAS were accessed for this refinement. No production
-deployment, physical microphone, real TTS or native qualification is claimed.
-Existing dirty iOS, AGENTS and design changes were left untouched. No commit or
-push was performed.
+The local qualification above accessed no credentials, live APIs or NAS and did
+not itself deploy anything. Existing dirty iOS, AGENTS and design changes were
+left untouched. Physical microphone, real TTS and native qualification remain
+outside this refinement.
+
+### Authorized production follow-up
+
+After user deployment authorization, release `8905dc2` was pushed to `master` and
+[Gitea run248](https://git.srmr.xyz/snowspeeder/hope-voice-api/actions/runs/248)
+succeeded, completing at `2026-10-04T14:38:47Z`. Python 3.12 backend CI passed:
+**148 passed in 68.09s**, with one Starlette deprecation warning; theme checks
+also passed. The 47-test offline browser receipt above remains separate evidence.
+
+Parent SSH verification found the production voice container running and healthy,
+started at `2026-10-04T14:38:23Z`, with image
+`sha256:e4fb1bdbe73e44c27a8d1b68d75830f15af6b8fdaa5d5742403c4a6beb8a4175`.
+The control image was unchanged (reported prefix `db756e976829`); its container
+restarted at `2026-10-04T14:38:20Z`, remained running, and `/health` returned OK.
+Rollback containers with suffix `20261004T143816Z` were retained stopped.
+Final live verification passed (parent receipt `bash-1839`, exit 0): all seven
+web entrypoint assets returned HTTP 200 and matched release `8905dc2` byte-for-byte
+and by SHA256. Anonymous `GET /api/auth/me` and `POST /token` both returned 401.
+Fresh mobile Chromium at 390×844 showed the login ready and visible with the
+authenticated app hidden, zero JavaScript or console errors, zero unexpected
+requests, and no horizontal overflow. Screenshot receipt:
+[/tmp/hope-voice-live-login.png](/tmp/hope-voice-live-login.png).
+The inspection client alone accepted the self-signed TLS certificate; production
+TLS policy was not changed. No authenticated account-data or CRUD, live voice,
+physical microphone, real TTS or native verification is claimed by this
+deployment receipt.
 
 ## Web UX refinement — 2026-10-04 (production deployed)